Hi!
We faced with the same problem and found no good solution better than the dirty trick, described below. Do not do it if you are not sure! Also the solution assumes there is no sensitive data in the attachments, as it bypasses the access control completely.
Our Jira Service Desk runs on Ubuntu+Apache2 and stores the attachments in /var/atlassian/application-data/jira/data/attachments/HELPD (HELPD is service desk application name)
1. Add www-data user to jira group:
sudo usermod -a -G jira www-data
2. Create a symbolic link to the attachments dir from somewhere else:
ln -s /var/atlassian/application-data/jira/data/attachments/HELPD /var/www/helpdesk_attachments/
3. Some sub-directories in /var/atlassian/application-data/jira/data/attachments/HELPD path are accessible for jira user only. Check all subdirs and change their permissions (if needed) with
chgrp jira /var/atlassian/application-data/jira/
chmod 750 /var/atlassian/application-data/jira/
Now you should be able to list attachments file structure with a command like
ls -R /var/www/helpdesk_attachments/*
4. In apache2 config of your site add the lines (it assumes Jira is configured with /jira URL prefix):
ScriptAlias "/jira/secure/attachment" "/var/www/helpdesk_attachments/index.php"
ProxyPass /jira/secure/attachment !
before
ProxyPass /jira http://localhost:8040/jira
ProxyPassReverse /jira http://localhost:8040/jira
5. Create PHP script /var/www/helpdesk_attachments/index.php with the content
<?php
$pieces = explode("/", $_SERVER['REQUEST_URI']);
$size = sizeof($pieces);
$files = glob(getcwd() . "/*/*/*/" . $pieces[$size-2]);
$filepath = $files[0];
if(file_exists($filepath)){
$filename = $pieces[$size-1];
$prefix = $pieces[$size-2] . '_';
$filename = preg_replace("/^$prefix/", '', $filename);
$mime = getMime($filename);
header('Content-Type: ' . $mime);
header('Content-Disposition: attachment; filename=' . $filename);
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($filepath));
ob_clean();
flush();
readfile($filepath);
exit;
}
function getMime( $filename ) {
$types = array(
'ai' => 'application/postscript',
'asc' => 'text/plain',
'avi' => 'video/x-msvideo',
'bin' => 'application/octet-stream',
'bmp' => 'image/bmp',
'class' => 'application/octet-stream',
'css' => 'text/css',
'csv' => 'text/csv',
'doc' => 'application/msword',
'dtd' => 'application/xml-dtd',
'eps' => 'application/postscript',
'gif' => 'image/gif',
'htm' => 'text/html',
'html' => 'text/html',
'ico' => 'image/x-icon',
'jpeg' => 'image/jpeg',
'jpg' => 'image/jpeg',
'js' => 'application/x-javascript',
'json' => 'application/json',
'mathml' => 'application/mathml+xml',
'mov' => 'video/quicktime',
'mpeg' => 'video/mpeg',
'mpg' => 'video/mpeg',
'pdf' => 'application/pdf',
'png' => 'image/png',
'ppt' => 'application/vnd.ms-powerpoint',
'ps' => 'application/postscript',
'qt' => 'video/quicktime',
'rtf' => 'text/rtf',
'svg' => 'image/svg+xml',
'svgz' => 'image/svg+xml',
'swf' => 'application/x-shockwave-flash',
'tar' => 'application/x-tar',
'tif' => 'image/tiff',
'tiff' => 'image/tiff',
'tsv' => 'text/tab-separated-values',
'txt' => 'text/plain',
'xhtml' => 'application/xhtml+xml',
'xls' => 'application/vnd.ms-excel',
'xml' => 'application/xml',
'xsl' => 'application/xml',
'xslt' => 'application/xslt+xml',
'zip' => 'application/zip',
'eml' => 'message/rfc822'
);
$path_info = pathinfo($filename );
$ext = strtolower($path_info[extension]);
$mime = $types[$ext];
if ( $mime === null ) {
$mime = "text/plain";
}
return $mime;
}
?>
In the code there is a redundant getMime() implementation. For some reason on our system the standard PHP's mime_content_type() does not work, so it was easier/safer not to troubleshoot the prod system, but to implement a minimalist replacement.
6. Add error handling to the index.php if you find it is needed.
7. restart Apache with sudo service apache2 restart
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.